Next.js Patches Critical RCE Flaws — Update Now

Vercel shipped an out-of-band Next.js security release on October 14, 2026, patching two Critical-severity remote-code-execution vulnerabilities and one High-severity denial-of-service bug. The fixes landed in Next.js 16.4.1 (Active LTS) and 15.5.28 (Maintenance LTS, covering everything from 10.x through 15.x). Singapore's Cyber Security Agency followed on October 20 with alert AL-2026-148, urging teams to patch immediately. If you run Next.js in production, this is a "stop and update today" release, not a routine point bump.

What happened on October 14

Vercel's Next.js team pushed an out-of-band security release — meaning it fell outside the normal release cadence — to address three vulnerabilities, two of which the project's own advisories rate as Critical. According to the official Next.js blog post, the release had been flagged a week earlier and included two fixes that had originally been slated for the September 2026 security release but were delayed by upstream dependency timing. Fixed builds are available now as [email protected] for the 16.4 line and [email protected] for the 15.5 line, installable with a standard npm install [email protected] or npm install [email protected].

This patch round lands just a week after Next.js 16.4 shipped with Cache Components on by default — a release Pandromeda covered in detail here. That timing matters: the most severe of the three new bugs lives specifically in Cache Components' "use cache" mechanism, so teams that upgraded to 16.4 to get the new caching model are squarely in the blast radius and need to move again, to 16.4.1.

The headline flaw: unauthenticated RCE via "use cache"

The most serious issue, tracked by GitHub as GHSA-673q-mjm6-r5xr, affects applications built on the App Router that use Cache Components. Per Vercel's advisory, the bug triggers when a function marked "use cache" returns multiple typed arrays (think Uint8Array, Float64Array, and similar binary-data types) — a condition that lets an unauthenticated, remote attacker achieve arbitrary code execution on the server, no login or user interaction required.

The advisory's CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H) works out to a base score of 9.5, and GitHub flags confidentiality, integrity, and availability impact as High across the board. The root cause traces upstream to React itself, documented in a companion advisory, GHSA-xqc2-xf4c-x3h3, on the React repository.

Two details push this from "serious" to "drop everything": first, Vercel states plainly that there is no known workaround — the only fix is upgrading. Second, the advisory specifically warns that teams should patch immediately "even if your application does not have similar functions," since the vulnerable code path lives in framework internals rather than anything a developer would obviously flag in their own code review. As of publication, this flaw had not yet been assigned its own CVE identifier; it is tracked solely by its GHSA number. The affected range is Next.js 16.0.0 through 16.4.0; it does not reach back into the 15.x or earlier lines, since Cache Components is a 16.x-era feature.

The second Critical flaw: Image Optimization RCE on glibc Linux

The other Critical-rated bug is CVE-2026-96889, tracked on GitHub as GHSA-2464-fhr4-w9xw. It sits in Next.js's built-in Image Optimization API when processing SVG files, and Vercel describes it as "a memory-related vulnerability in an upstream library" that can lead to remote code execution specifically when Next.js runs on glibc-based Linux hosts — the default for most cloud VM images and containers.

The NVD record for CVE-2026-96889 traces the underlying defect to librsvg, the SVG-rendering library that the sharp image-processing package (used internally by Next.js's Image Optimization pipeline) relies on. Red Hat's own write-up describes a use-after-free: when librsvg parses an SVG document containing nested XML inclusions (XIncludes) with duplicate entity declarations, it can free an XML entity that the parser is still using, corrupting memory in a way that can be steered toward code execution or, at minimum, a crash. NVD's CVSS 3.1 score for the librsvg CVE itself is a comparatively modest 7.8 (local attack vector, since that scoring reflects generic library usage) — but GitHub's Next.js-specific advisory and Singapore's CSA both score the Next.js-reachable version at 9.5 on CVSS 4.0, because the Image Optimization API exposes the flaw to unauthenticated network attackers, not just local processes.

Vercel does offer a workaround here, unlike the cache bug: ensuring the copy of sharp that Next.js uses is version 0.35.5 or later, which ships a patched librsvg. Upgrading Next.js to 15.5.28 or 16.4.1 handles this automatically, since fresh installs and updated lockfiles pull in the fixed sharp version. The affected range spans a wide swath of history: 10.0.0 through 15.5.27 on the old major-version lines, and 16.0.0 through 16.4.0 on current.

The third bug: denial of service via Server Actions

Rounding out the release is GHSA-p3m5-59mp-jv5r, rated High severity with a CVSS 4.0 score of 8.2. Vercel's description: crafted requests targeting App Router applications that use at least one Server Action can drive excessive CPU usage, and that CPU load blocks the same process from handling further requests — a classic denial-of-service pattern. A related upstream React advisory, GHSA-h3gv-c5rc-p453, covers the same root cause on the React side.

Applications built entirely on the Pages Router, or App Router apps that don't define any Server Actions, are not affected by this particular bug. As with the cache-function flaw, Vercel says no workaround exists short of upgrading. Affected versions run from 13.0.0 through 15.5.27 and 16.0.0 through 16.4.0.

Affected and fixed versions at a glance

In practice: if you're anywhere on the 10.x–15.x line, move to 15.5.28; if you're on 16.x, move to 16.4.1. There is no partial fix — each advisory ties its remediation to these exact builds.

Singapore's CSA issues a public alert

On October 20, 2026, Singapore's Cyber Security Agency published alert AL-2026-148, "Critical Vulnerabilities in Next.js" (last updated October 23). CSA alerts of this kind are reserved for vulnerabilities the agency judges to pose an immediate, widespread risk — in this case citing the 9.5 CVSS 4.0 score on the lead flaw and the fact that exploitation requires no authentication. The alert names both Critical-rated issues — the "use cache" RCE and the Image Optimization RCE — and directs organizations running Next.js to update to the fixed versions without delay.

A national CSA bulletin is a useful signal for prioritization even outside Singapore: government cyber agencies typically only escalate a framework-level advisory to a public alert when the combination of reach (Next.js runs an enormous share of production React apps), severity, and unauthenticated exploitability crosses a specific risk threshold. Treat it as independent confirmation that this is not routine patch-cycle noise.

Don't confuse this with CVE-2026-44578

If you've been tracking Next.js CVEs this year, you may recall CVE-2026-44578, a separate, unrelated High-severity (CVSS 3.1: 8.6) server-side request forgery bug. That issue affected self-hosted applications using Next.js's built-in Node.js server, where crafted WebSocket upgrade requests could trick the server into proxying requests to arbitrary internal or external destinations — potentially exposing internal services or cloud metadata endpoints. Vercel-hosted deployments were never affected, and the bug was already fixed back in 15.5.16 and 16.2.5, months before this October release.

It's easy to conflate the two because both involve Next.js, both carry high severity scores, and both are network-exploitable — but they're different bugs, in different subsystems, fixed in different releases. If your app is already on 15.5.16/16.2.5 or later, CVE-2026-44578 is closed; it has no bearing on whether you still need this October patch for the two Critical flaws above.

Is this being exploited right now?

Per Vercel's own advisory text, the company reports no evidence of exploitation in the wild at the time of the October 14 release, and no confirmed public proof-of-concept exploit. That said, "no known exploitation yet" is not the same as "safe to wait." Unauthenticated, network-reachable RCE bugs in a framework as widely deployed as Next.js — which underpins a large share of production React applications — tend to attract automated scanning and exploit development quickly once the patch itself reveals the shape of the bug through diffing. The combination of a 9.5 CVSS score, no available workaround for the lead flaw, and a national CSA alert is the kind of signal security teams generally treat as "patch within hours, not sprint-planning cycles."

How to check if you're affected, and how to update

Start by checking your installed version:

A few things worth flagging for specific setups:

• Using Cache Components / "use cache" on 16.x? You're in the direct blast radius of the headline RCE — prioritize this update above the other two.
• Self-hosting on glibc-based Linux (most standard Ubuntu/Debian-based containers and VMs) and serving user-supplied SVGs through Image Optimization? You're exposed to the second Critical flaw until you update or confirm sharp ≥0.35.5.
• Running App Router with any Server Actions? The DoS bug applies regardless of whether you use Cache Components, so update regardless.
• On Vercel's managed platform? Vercel typically patches platform-level exposure quickly, but self-managed dependency versions in your own repository still need the version bump — check your package.json and lockfile directly rather than assuming hosting alone covers it.

Teams that found Next.js 16.4's new caching defaults (covered in our earlier report on Cache Components) a significant enough change to warrant careful rollout should treat this as the mandatory follow-up patch to that same release line. For a sense of how other frameworks have handled similarly urgent, unauthenticated RCE disclosures this year, see our coverage of the critical PHP RCE flaws patched under the PHP2Shell banner and the GitLab CVE-2026-97229 critical RCE patch — both followed the same "no workaround, upgrade now" pattern.

Why this release matters beyond the CVE count

Out-of-band security releases are relatively rare for Next.js; most security fixes ride along with scheduled minor or patch releases. Shipping outside that cadence, bundling two Critical-severity, unauthenticated RCE bugs, and drawing a same-week public alert from a national cybersecurity agency is a combination that doesn't happen often for any single framework release. It also underscores a recurring theme in modern framework security: both Critical bugs here trace back to upstream dependencies — React's internals for the cache bug, and librsvg via sharp for the image bug — rather than application code that Next.js users wrote themselves. That's a reminder that staying current with framework point releases is doing double duty: it's not just picking up new features like Cache Components, it's also the only reliable channel through which these upstream fixes reach your production servers.

What to do next

If you run Next.js anywhere in production — self-hosted, on Vercel, or on another platform — treat this as a same-day task: confirm your version, bump to 16.4.1 or 15.5.28, redeploy, and restart any persistent server processes. There's no partial mitigation for the lead flaw, and the DoS and image-optimization bugs both close with the same version bump, so there's no reason to patch piecemeal. Bookmark the official Next.js security advisory and subscribe to the project's GitHub Security Advisories directly, so the next out-of-band release doesn't arrive as a surprise.

Written byFelix Moreau

Felix Moreau writes Pandromeda's software coverage and how-to guides. He covers Windows, macOS and Linux updates, the apps people rely on, emulators and developer tools, and turns official documentation into clear, numbered steps that work on the current version.

More from Felix MoreauAll Software & Guides coverage